Cloud Digital Leader How Google Cloud Resources Are Managed Practice Question
A company uses folders to separate environments (dev, test, prod) and teams (eng, data, security). An engineer needs to apply a policy that disables the use of 'g1-small' machine types only in the 'dev' folder under the 'eng' folder. The organization node has no existing constraints. What is the most specific way to apply this policy?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Apply the policy at the 'dev' folder.
Organization policies can be applied at the folder level. To be specific to 'dev' under 'eng', apply the policy to the 'dev' folder. Applying at a higher level would affect other subfolders.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Apply the policy at the organization node.
Why it's wrong here
Applying at the organization node puts the policy at the very top of the resource hierarchy, so it is inherited by every folder, project, and resource, including production and non-engineering folders. That gives you no ability to isolate only the dev branch under eng. You need a narrower scope than the whole organization to enforce an environment-specific restriction.
- ✗
Apply the policy at each project individually.
Why it's wrong here
Applying the policy to each project individually means you must re-create the same constraint on every dev project and remember to apply it to any future dev project that is created. This is error-prone and makes audits harder because the rule is fragmented across projects rather than defined once at the folder boundary. Folder-level inheritance gives you a single, consistent control point at the dev folder, reducing duplicate effort and the risk of a project being missed.
- ✓
Apply the policy at the 'dev' folder.
Why this is correct
The dev folder is the node in the resource hierarchy that contains only development projects and subfolders under eng; applying the policy there inherits to all of those descendants. Because the policy does not flow upward or to sibling folders like test or prod, this is the precise way to scope the restriction to just the dev environment. It leverages the hierarchy to define the policy exactly where the environment boundary is intended.
- ✗
Apply the policy at the 'eng' folder.
Why it's wrong here
The eng folder is the parent of dev, test, and prod environment folders, so any policy applied at eng propagates downward to all of its children. That means the restriction would also be inherited by test and prod workloads, which are not in the dev environment and likely should not have that constraint. This is a case of setting the policy at too coarse a folder level; the correct scope is the dev folder itself, not its parent.
Go deeper
Related to this question
Learn chapter
Security on Google Cloud
Key term
Organization
An Organization is a top-level container in Google Cloud that represents your company or entities and serves as the root node for all your cloud resources, policies, and access control.
Key term
Folder
A folder is a logical container used to organize and group digital files, resources, or cloud-based assets within a system or platform.
About these practice questions
This GCDL question is part of Courseiva's 829-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.